Summary: | Objects with numeric properties intermittently get a phantom 'length' property | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | osolo | ||||||
Component: | JavaScriptCore | Assignee: | Michael Saboff <msaboff> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | caitp, fpizlo, ggaren, jstephenson-wkbgz, mathias, m.goleb+bugzilla, mhahnenb, msaboff, osolo, ossy, webkit-bug-importer, ysuzuki | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | iPhone / iPad | ||||||||
OS: | iOS 8.1 | ||||||||
Bug Depends on: | |||||||||
Bug Blocks: | 108645 | ||||||||
Attachments: |
|
Description
osolo
2015-03-17 14:53:56 PDT
ossy, now I think it may be related to aarch64 failures with "length" property. I can reproduce on iOS ARM64 in ToT (r182023) WebKit. It doesn't happen in on ARM32 or Mac. Curious. Created attachment 249534 [details]
Converted supplied test into a regression test
Looks like we have a bad instruction optimization when comparing a literal with a single bit to a register in MacroAssemblerARM64::branchTest32(). Patch in progress. Created attachment 249564 [details]
Patch
Comment on attachment 249564 [details]
Patch
nice catch, r=me
Committed r182058: <http://trac.webkit.org/changeset/182058> This might be my favorite bug/fix ever. *** Bug 142575 has been marked as a duplicate of this bug. *** It would be great to have it backported to iOS 8. If that's not planned (or if it's planned but we're be notified about that) we'll have to publish another patch release of jQuery dedicated to Safari; the first one was: http://blog.jquery.com/2014/12/18/jquery-1-11-2-and-2-1-3-released-safari-fail-safe-edition/ |